In researching my problem for this question, I discovered that the SID for the account in the domain named "Administrator" account is:
That's got to be wrong, because real Administrator SID's end in 500. Using the same domain key and looking for SID
S-1-5-21-2025429265-492894223-1708537768-500 turns up nothing — the built-in Administrator account just isn't there.
I don't know when or how this happened and I'm still looking, but I'm pretty sure it's been like this long enough that I don't even have a backup I could restore that would address this.
Does anyone have any ideas for how to put it right?
Since the account I'm talking about apparently isn't clear, I mean the account referred to in the 2nd bullet point under the "Causes" heading in this knowledge base article:
The Administrator account Well-Known Security Identifier, or SID (the account name can be renamed)